Analysis
-
max time kernel
146s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 20:36
Static task
static1
Behavioral task
behavioral1
Sample
0ed539430e54b35f9b8b59755b35609925f44d6f02c42a1c2eb3ad9db7457fe6.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
0ed539430e54b35f9b8b59755b35609925f44d6f02c42a1c2eb3ad9db7457fe6.exe
Resource
win10v2004-20221111-en
General
-
Target
0ed539430e54b35f9b8b59755b35609925f44d6f02c42a1c2eb3ad9db7457fe6.exe
-
Size
1.7MB
-
MD5
e34628c4a5c496155a5ad635091d4846
-
SHA1
f4853d9610fc333dafb24f694b4a7fe7b90931cd
-
SHA256
0ed539430e54b35f9b8b59755b35609925f44d6f02c42a1c2eb3ad9db7457fe6
-
SHA512
6d3a0eb441e92c8248dd8308883a4eaa5c772ea3e26d4e7f26abab316b1aa7b6c486012500da26d783a4260691737908b0bafd5c54ca64b991357f19ea08dc25
-
SSDEEP
24576:J95za11m9OUbjRC+9nLe6mh5Cbybu7tG8ku2N+E/0DHqrKh+3m5n+NSpqoaR/pl7:ZSbrYrpqoK/fQ2Ayod0iEU5Ol4Y
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1256-132-0x0000000002AD0000-0x0000000002B42000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
0ed539430e54b35f9b8b59755b35609925f44d6f02c42a1c2eb3ad9db7457fe6.exepid process 1256 0ed539430e54b35f9b8b59755b35609925f44d6f02c42a1c2eb3ad9db7457fe6.exe 1256 0ed539430e54b35f9b8b59755b35609925f44d6f02c42a1c2eb3ad9db7457fe6.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
0ed539430e54b35f9b8b59755b35609925f44d6f02c42a1c2eb3ad9db7457fe6.exepid process 1256 0ed539430e54b35f9b8b59755b35609925f44d6f02c42a1c2eb3ad9db7457fe6.exe 1256 0ed539430e54b35f9b8b59755b35609925f44d6f02c42a1c2eb3ad9db7457fe6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ed539430e54b35f9b8b59755b35609925f44d6f02c42a1c2eb3ad9db7457fe6.exe"C:\Users\Admin\AppData\Local\Temp\0ed539430e54b35f9b8b59755b35609925f44d6f02c42a1c2eb3ad9db7457fe6.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1256